28Hus commented on PR #1565: URL: https://github.com/apache/dubbo-admin/pull/1565#issuecomment-5842541873
> ## Copilot review overview > ### 🟡 Changes recommended > A `console: null` configuration bypasses validation and starts with an empty, forgeable signing key. > > **Review effort:** Balanced **Findings:** 1 <img alt="High severity" width="62" height="18" src="https://camo.githubusercontent.com/3a45afe3f70ffe1b8bd7e55cd010b3cfdea3251a5d0661ebd6237ecb6846bcb6/68747470733a2f2f6769746875622e6769746875626173736574732e636f6d2f7374617469632f696d616765732f69636f6e732f636f70696c6f742d636f64652d7265766965772f686967682d76322d6c696768742e706e67";> · 2 <img alt="Medium severity" width="62" height="18" src="https://camo.githubusercontent.com/61bc3f51460c23a17b60ad45bd0941ac833960ebf1f0f46c74b915e68f750e93/68747470733a2f2f6769746875622e6769746875626173736574732e636f6d2f7374617469632f696d616765732f69636f6e732f636f70696c6f742d636f64652d7265766965772f6d656469756d2d76322d6c696768742e706e67";> > > **Open (3)** > * <img alt="High severity" width="62" height="18" src="https://camo.githubusercontent.com/3a45afe3f70ffe1b8bd7e55cd010b3cfdea3251a5d0661ebd6237ecb6846bcb6/68747470733a2f2f6769746875622e6769746875626173736574732e636f6d2f7374617469632f696d616765732f69636f6e732f636f70696c6f742d636f64652d7265766965772f686967682d76322d6c696768742e706e67";> [Validate the default console configuration after nil replacement](#discussion_r4109809327) · New > * <img alt="Medium severity" width="62" height="18" src="https://camo.githubusercontent.com/61bc3f51460c23a17b60ad45bd0941ac833960ebf1f0f46c74b915e68f750e93/68747470733a2f2f6769746875622e6769746875626173736574732e636f6d2f7374617469632f696d616765732f69636f6e732f636f70696c6f742d636f64652d7265766965772f6d656469756d2d76322d6c696768742e706e67";> [Clear session secret environment variable in missing-secret test](#discussion_r4109809348) · New > * <img alt="Medium severity" width="62" height="18" src="https://camo.githubusercontent.com/61bc3f51460c23a17b60ad45bd0941ac833960ebf1f0f46c74b915e68f750e93/68747470733a2f2f6769746875622e6769746875626173736574732e636f6d2f7374617469632f696d616765732f69636f6e732f636f70696c6f742d636f64652d7265766965772f6d656469756d2d76322d6c696768742e706e67";> [Isolate environment fallback in missing-secret validation test](#discussion_r4109809364) · New > > **What changed in this PR** > Hardens session-cookie signing by requiring a deployment-specific secret. > > **Changes:** > > * Removes the insecure default and enforces a 32-byte minimum. > * Supports environment-based secret injection. > * Updates tests, examples, Kubernetes configuration, and documentation. > > File Description > `pkg/​config/​console/​auth/​config.go` Validates and loads session secrets. > `pkg/​config/​console/​auth/​config_test.go` Tests secret validation and environment loading. > `pkg/​config/​console/​config.go` Removes the default signing secret. > `pkg/​config/​console/​config_test.go` Tests password and provider configurations. > `app/​dubbo-admin/​dubbo-admin.yaml` Documents required local configuration. > `app/​dubbo-admin/​dubbo-admin-oauth-example.yaml` Updates the OAuth example. > `release/​kubernetes/​dubbo-system/​dubbo-admin.yaml` Injects a Kubernetes Secret. > `docs/​server-develop.md` Documents secret generation and configuration. > 💡 [Add a `code-review` agent skill](/apache/dubbo-admin/new/develop?filename=.github/skills/code-review/SKILL.md) or configure MCP servers for context-aware, tailored reviews. [Learn more in the docs.](https://docs.github.com/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review?tool=webui#mcp-servers-and-agent-skills) > @28Hus please resolve the comments the copilot left and give feedbacks to me if there are any problems. @robocanic Thanks for the reminder; I am looking into it and planning to make changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
